There is a lot of discussion about the technology behind NIS2: firewalls, logging, and incident management. What receives less attention is that the legislation explicitly outlines what management must do, and one requirement is easy to overlook: the board of directors and CEO must undergo cybersecurity training to make informed decisions.
